Protection in place
The hosted site uses HTTPS. Admin passwords are stored as salted scrypt hashes rather than readable passwords. Admin changes require a valid session, and the backend checks request origins and security tokens. Session cookies are inaccessible to page JavaScript and expire after eight hours.
Repeated login attempts are limited. Product inputs and upload types are checked before storage. Database and backend source files are not publicly served. Uploaded product photos are public by design so shoppers can see them.
These measures reduce risk, but no website or storage system can be guaranteed completely secure. The current admin area does not provide two-factor authentication.
Keeping your admin account safe
Use a strong, unique password and sign out on shared devices. Do not share accounts, passwords, session cookies or security tokens. Keep devices and browsers updated. If you suspect someone has accessed your account, contact martgsv@gmail.com and ask the operator to revoke sessions and reset access.
Only upload images you are authorized to publish. Avoid faces, addresses, documents or other personal information unless you have a legitimate reason and permission to make them public.
Report a vulnerability
Email martgsv@gmail.com with the subject “Security report”. Include the affected page, a description of the issue, minimal steps to reproduce it, and the likely impact. Redact any passwords, tokens and personal information from screenshots or examples.
Limit investigation to your own account and data you are authorized to access. Do not change or delete other people’s data, extract sensitive records, overload the service, or test third-party marketplaces. If you encounter personal data unexpectedly, stop testing and report the issue privately.
We will review reports and contact you when more information is needed. This reporting process is not a bug bounty programme and does not promise payment, a response deadline or permission for unrestricted testing.
Security incidents
When a credible report or incident is identified, we may restrict access, invalidate sessions, investigate affected data and work with service providers to address the issue. Where notification is required by applicable law, we will follow those requirements.
For information about personal data used in protecting the site, read our Privacy & data collection policy.